Effective date: 2 November 2026
9.1 Roles
For the purposes of this DPA, and as between you and Ezyiah, you determine the purposes for which Customer Data is collected and used in connection with your business or professional services, and Ezyiah processes that data on your behalf to provide the Services and in accordance with these Terms. The terms 'controller' and 'processor', where used, are descriptive contractual concepts only and do not alter or replace the roles, responsibilities or obligations imposed by the Privacy Act 1988 (Cth), the APPs or any other applicable law. For a business account or workspace, the business owns its account, workspace and Customer Data, including where an Invited Adviser set it up, and the Business Owner determines those purposes for its Business Records, including information about Your Customers and Your Suppliers. Invited Advisers and Team Members access that data under the authority granted by the Business Owner or account administrator, and an Invited Adviser remains responsible for its own handling of data under its engagement with the business and its professional obligations.
9.2 Processing activities
Processing includes collecting, storing and processing Customer Data to provide the Services; generating Output; processing Bank Feed Data through Fiskil; maintaining AI Memory datasets, including firm-wide AI Memory that learns categorisation and coding patterns from the files of a firm's business clients and uses them only to assist that firm across its own client files; processing depreciation and asset data; processing Business Records, customer and supplier information, products and services, inventory data and Team Member and Invited Adviser access information; reading receipts, bills and invoices and matching them to transactions; sending Quotes, Invoices and related messages from an Ezyiah email address, on your behalf, to recipients you nominate; generating Business Dashboard metrics and AI Insights; and maintaining logs, analytics and security data.
9.2A Your instructions and warranties
You instruct us to process Customer Data as needed to provide the Services you use, including sending Quotes and Invoices to the recipients you select. You warrant that personal information you provide, including details of Your Customers, Your Suppliers, Team Members and clients, has been collected lawfully, that you have given any notices and obtained any consents required by the Privacy Act 1988 (Cth) and the APPs (to the extent they apply to you) or other law, and that our processing in accordance with your instructions will not breach any law, including the Spam Act 2003 (Cth) for messages you send through the Services. You are responsible for the content and recipients of those messages. Where you are an Invited Adviser using firm-wide AI Memory, you also warrant that you have the authority and any consent required from your clients for their files to contribute to firm-wide AI Memory, as described in section 4.5 of the AI Use and Disclosure Policy.
9.3 Our obligations
We process Customer Data only to provide the Services and as instructed; apply appropriate technical and organisational measures, as described in the Data Security and Information Handling Policy; ensure personnel are bound by confidentiality; and assist you, so far as reasonable, with access, correction, security and breach-notification obligations.
9.4 Sub-processors
We may engage sub-processors, including cloud hosting, Fiskil, AI infrastructure and email delivery providers, under written terms imposing comparable data-protection and confidentiality obligations. We remain responsible for the processing they perform on our behalf.
9.5 Cross-border transfers
Customer Data may be processed outside Australia, including by infrastructure providers such as Fiskil and our cloud and AI providers, with appropriate safeguards consistent with the APPs.
9.6 Breach assistance
We will notify you without undue delay after becoming aware of a data breach affecting your Customer Data and will assist you with your obligations, as described in the Incident Response and Breach Notification Policy. This includes a breach affecting personal information of Your Customers, Your Suppliers or Team Members held in your account.
9.7 Return and deletion
On termination, we handle Customer Data as set out in the Record Retention and Deletion Policy. Where an Invited Adviser's access to a business's workspace is revoked, the business's Customer Data remains in the business's account and continues to be handled under this DPA.
9.8 Compliance
We will comply with the APPs and other applicable privacy laws to the extent they apply to us and will assist you, so far as reasonably practicable and proportionate to the Services, to meet applicable privacy obligations relating to Customer Data processed through the Services.